Associate Cyber Risk Analyst

The Associate Cyber Risk Analyst coordinates governance, risk, and compliance activities that support UFCU’s cybersecurity program. This role organizes participation in internal audits and third-party due diligence, maintains cybersecurity program knowledge and records, coordinates the development and lifecycle of security processes and procedures, and administers the security awareness training and phishing exercise program. The Associate Cyber Risk Analyst partners with Information Security, Risk Management, Internal Audit, Compliance, Legal, Human Resources, Technology, and business teams to collect evidence, track commitments, improve documentation, and promote secure behaviors across the organization.

The Associate Cyber Risk Analyst is an exempt position and reports to the Director, Information Security, and is part of the Information Security team at UFCU.

Our Credit Union was founded in 1936 and has grown to serve members throughout Texas and beyond. At UFCU, we are more than just a financial institution, and our people are more than just employees. We are dedicated to our purpose of empowering our Members to achieve financial success and build brighter futures.

In Pursuit Of Our Aspiration That UFCU Is Loved By Millions Of Members And Built To Thrive For Generations, We Are Guided By Our Values

• Purposefully Member-Obsessed:
  We are driven by a profound sense of empathy to deeply understand our Members’ needs and preferences, what brighter futures means to them, and the obstacles in their way. We act in our Members’ best interests, forever seeking to empower their financial success.
• Possibilities Reimagined:
  We are inspired to courageously experiment, learn, and iterate in pursuit of positive impact for our Members, UFCU, and coworkers. We challenge assumptions, embrace diverse perspectives, and make use of data and insights.
• Performance Excellence Rooted in Unwavering Integrity:
  We do the right thing, always. We champion teamwork, accountability, continuous improvement, and celebrate successful outcomes of others, fostering an inclusive environment of excellence and collaboration.

• Coordinate, organize, and manage Information Technology participation in internal audits, external audits, regulatory examinations, risk assessments, and control reviews.
• Maintain audit schedules, evidence inventories, request lists, stakeholder assignments, due dates, dependencies, and status reporting from initiation through closure.
• Collect, review, organize, and securely retain audit evidence to support accurate, complete, and timely responses.
• Facilitate meetings among auditors, vendors, control owners, subject matter experts, and leadership; document decisions, action items, and follow-up commitments.
• Track findings, management responses, remediation plans, and evidence of closure; elevate delays, risks, and resource constraints to Information Security leadership.

• Maintain the cybersecurity program’s authoritative documentation repository, including standards, procedures, control narratives, evidence, risk records, decisions, meeting materials, metrics, and program artifacts.
• Organize cybersecurity information using consistent taxonomy, naming, ownership, version control, retention, review dates, and access permissions.
• Coordinate recurring reviews with document owners to validate accuracy, remove obsolete content, and preserve institutional knowledge.
• Prepare dashboards, reports, presentations, and program updates that communicate cybersecurity activities, risks, trends, and commitments to technical and business audiences.
• Support records retention, legal hold, privacy, and…